FrankenPHP Uncontrolled Recursion in PHP-to-Go Array Converter

Executive Summary

FrankenPHP before 1.13.2 has an uncontrolled recursion flaw in its PHP-to-Go array converter. When a self-referential PHP array is passed to frankenphp_log() or returned from a worker callback, it causes a Go stack overflow, crashing the entire server process.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for FrankenPHP versions before 1.13.2 and analyzing PHP applications for self-referential arrays passed to frankenphp_log() or worker callbacks. No specific commands are provided in the context, but monitoring for server crashes or stack overflow errors during PHP-to-Go array conversion may indicate exploitation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause denial-of-service by crashing the server when processing malicious input. It may lead to unexpected downtime and service disruption for applications using affected FrankenPHP versions.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FrankenPHP to version 1.13.2 or later to address the uncontrolled recursion flaw. Review PHP code for self-referential arrays passed to frankenphp_log() or worker callbacks and remove such constructs. Implement input validation to prevent circular references in arrays.

Useful 0 Not Useful 0